Add an option to encrypt an unencrypted partition (and decrypt an encrypted partition) in place.

Most of the stuff to do this should already be present, short of the iv generation (which is trivial anyway).

Brownie points for adding an optional AES backend using the AESNI instructions.